V8 npm Package Vulnerability: Active Exploitation Reported
- Severity
- HIGH
- Affected component
- v8 (npm)
- Patched version
- Not yet available
The V8 npm package, Chrome's JavaScript and WebAssembly engine, has a vulnerability that is reportedly under active exploitation. Users of this package should assess their exposure and take immediate action.
What happened
An out-of-bounds bug in V8, identified as CVE-2026-87491, has come under active exploitation. This vulnerability allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Security researcher Jihyeon Jeong of Compsec Lab, Seoul National University, discovered and reported the flaw. Google has acknowledged the existence of an exploit in the wild but has not disclosed specifics on its use or the attacker.
To assess your exposure, check if your applications or services use the V8 npm package. Since no authoritative version range has been published, it is advisable to assume all versions may be vulnerable until further notice. Monitor the provided sources for updates on affected versions and patches.
What to do about it
- Monitor the NCSC and The Hacker News sources for updates on the vulnerability and any patches.
- Assume all versions of the V8 npm package may be vulnerable until official information is released.
- Prepare to upgrade to the latest version of V8 once it becomes available.
- Check your environments for any signs of exploitation.
- No official fix has been published yet. Continue to monitor the sources below for updates.
How 0Day would have caught this
v8 is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
If your applications or services use the V8 npm package, you may be affected. Since no authoritative version range has been published, it is advisable to assume all versions may be vulnerable.
What should I do right now?
Monitor the NCSC and The Hacker News sources for updates on the vulnerability and any patches. Prepare to upgrade to the latest version of V8 once it becomes available and check your environments for any signs of exploitation.
Has this been exploited in the wild?
Yes, Google has acknowledged that an exploit for CVE-2026-87491 exists in the wild.